Kaspersky vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-27535 Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' High 7.8 · Aug 5, 2022
• CVE-2022-27534 Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing moduleCritical 9.8 · Apr 1, 2022
• CVE-2021-35052 A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.High 7.8 · Nov 23, 2021
• CVE-2021-35053 Possible system denial of service in case of arbitrary changing Firefox browser parameters.High 7.5 · Nov 3, 2021
• CVE-2020-27020 Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated paHigh 7.5 · May 14, 2021
• CVE-2020-36199 TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.Critical 9.8 · Jan 26, 2021
• CVE-2020-35929 In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool.Critical 9.8 · Jan 19, 2021
• CVE-2020-28950 The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate prHigh 7.8 · Dec 4, 2020
• CVE-2020-25045 Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack thHigh 7.8 · Sep 2, 2020
• CVE-2020-25044 Kaspersky Virus Removal Tool (KVRT) prior to 15.0.23.0 was vulnerable to arbitrary file corruption that could provide an attacker with the opportunity to eliminHigh 7.1 · Sep 2, 2020
• CVE-2020-25043 The installer of Kaspersky VPN Secure Connection prior to 5.0 was vulnerable to arbitrary file deletion that could allow an attacker to delete any file in the sHigh 7.1 · Sep 2, 2020
• CVE-2019-15695 TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor.High 7.2 · Dec 26, 2019
• CVE-2019-15694 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect.High 7.2 · Dec 26, 2019
• CVE-2019-15693 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient.High 7.2 · Dec 26, 2019
• CVE-2019-15692 TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow.High 7.2 · Dec 26, 2019
• CVE-2019-15691 TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder.High 7.2 · Dec 26, 2019
• CVE-2019-8287 TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution.Critical 9.8 · Oct 29, 2019
• CVE-2019-15683 TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e.Critical 9.8 · Oct 29, 2019
• CVE-2019-15681 LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory High 7.5 · Oct 29, 2019
• CVE-2019-15680 TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS).High 7.5 · Oct 29, 2019
• CVE-2019-15679 TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution.Critical 9.8 · Oct 29, 2019
• CVE-2019-15678 TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution..Critical 9.8 · Oct 29, 2019
• CVE-2019-8285 Kaspersky Lab Antivirus Engine version before 04.apr.2019 has a heap-based buffer overflow vulnerability that potentially allow arbitrary code executionHigh 8.8 · May 8, 2019
• CVE-2018-6290 Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.High 7.8 · Feb 6, 2018
• CVE-2018-6289 Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.Critical 9.8 · Feb 6, 2018